Windows 2000 Domain Naming System (DNS) Sida 1 av 46 TechNet Home > Products & Technologies > Server Operating Systems > Windows 2000 Server > Plan Windows 2000 DNS Operating System Abstract This paper describes the Microsoft® Windows® 2000 operating system Domain Naming System (DNS), including design, implementation, and migration issues. It discusses new features of the Windows 2000 implementation of DNS, provides examples of DNS implementations, and describes the architectural criteria that network architects and administrators should consider when designing a DNS namespace for the Active Directory™ service to provide reliable network naming services. On This Page Introduction DNS Fundamentals New Features of the Windows 2000 DNS Designing a DNS Namespace for the Active Directory Summary Glossary Introduction The designers of the Microsoft ® Windows® 2000 operating system chose the Domain Name System (DNS) as the name service for the operating system. Windows 2000 Server includes an IETF standard-based Domain Name System Server. Because it is RFC compliant it is fully compatible with any other RFC compliant DNS servers. Use of the Windows 2000 Domain Name System server is not mandatory. Any DNS Server implementation supporting Service Location Resource Records (SRV RRs, as described in an Internet Draft "A DNS RR for specifying the location of services (DNS SRV)") and Dynamic Update (RFC2136) is sufficient to provide the name service for Windows 2000–based computers1. However, because this implementation of DNS is designed to fully take advantage of the Windows 2000 Active Directory™ service, it is the recommended DNS server for any networked organization with a significant investment in Windows or extranet partners with Windows-based systems. For example, while conventional DNS Servers use single-master replication, Windows 2000 DNS can be integrated into Active Directory service, so that it uses the Windows 2000 multi-master replication engine. (Note that the Active Directory supports multi-master replication.) In this way, network managers can simplify system administration by not having to maintain a separate replication topology for DNS. DNS in Windows 2000 provides a unique DNS Server implementation that is fully interoperable with other standards-based implementations of DNS Server. Some special interoperability issues are discussed later in this paper. The purpose of this document is to assist network architects and administrators in planning the Windows 2000 Active Directory service DNS deployment strategy. It covers the design, implementation, and migration issues that need to be considered when rolling out a scalable and robust DNS solution as a global name service. While this paper assumes familiarity with DNS it provides a quick overview of the DNS basics in "DNS Fundamentals". The Windows 2000 implementation of DNS supports various new features (as compared to Windows NT® 4.0 operating system) described in "New Features of the Windows 2000 DNS." It includes the description of Active Directory integration and incremental zone transfer (IXFR), dynamic (including secure) update and Unicode character support, enhanced Domain Locator, caching resolver service and DNS Manager. It provides the detailed overview of the name resolution process. It also describes the support for secure DNS management. It includes an overview of the various issues associated with designing http://www.microsoft.com/technet/prodtechnol/windows2000serv/plan/w2kdns2.msp... 2006-04-04 Windows 2000 Domain Naming System (DNS) Sida 2 av 46 namespace for the Active Directory. It includes integration of Active Directory with existing DNS structure and migration to the Windows 2000 implementation of DNS, design of the private namespaces and necessary DNS support. Name Services in Windows 2000 DNS is the name service of Windows 2000. It is by design a highly reliable, hierarchical, distributed, and scalable database. Windows 2000 clients use DNS for name resolution and service location, including locating domain controllers for logon. Downlevel clients (Windows NT 3.5 and 3.51, Windows NT 4.0, Windows 95, and Windows 98), however, rely on NetBIOS which can use NBNS (WINS), broadcast or flat LmHosts file. In particular, the NetBIOS name service is used for domain controller location. Since DNS as implemented in Windows 2000 is Windows Internet Name Services (WINS)-aware, a combination of both DNS and WINS can be used in a mixed environment to achieve maximum efficiency in locating various network services and resources. Additionally, WINS in a legacy or mixed environment plays an important interoperability role while also preserving current investment. Windows NT 4.0–based clients can register themselves in Windows 2000 WINS and Windows 2000–based clients can register in Windows NT 4.0 WINS. Standards and Additional Reading The following documents are of interest in the context of the Windows 2000 DNS Server implementation. They are combined in two categories. A RFC—Request For Comments—is a standard document, while Draft is work in progress that can become a standard. RFCs: • 1034 Domain Names—Concepts and Facilities • 1035 Domain Names—Implementation and Specification • 1123 Requirements for Internet Hosts—Application and Support • 1886 DNS Extensions to Support IP Version 6 • 1995 Incremental Zone Transfer in DNS • 1996 A Mechanism for Prompt DNS Notification of Zone Changes • 2136 Dynamic Updates in the Domain Name System (DNS UPDATE) • 2181 Clarifications to the DNS Specification • 2308 Negative Caching of DNS Queries (DNS NCACHE) Drafts: • Draft-ietf-dnsind-rfc2052bis-02.txt (A DNS RR for Specifying the Location of Services (DNS SRV)) • Draft-skwan-utf8-dns-02.txt (Using the UTF-8 Character Set in the Domain Name System) • Draft-ietf-dhc-dhcp-dns-08.txt (Interaction between DHCP and DNS) • Draft-ietf-dnsind-tsig-11.txt (Secret Key Transaction Signatures for DNS (TSIG)) • Draft-ietf-dnsind-tkey-00.txt (Secret Key Establishment for DNS (TKEY RR)) • Draft-skwan-gss-tsig-04.txt (GSS Algorithm for TSIG (GSS-TSIG) ) For more information on these documents, go to http://www.ietf.org/. In addition to the listed RFCs and Drafts the implementation of the ATMA DNS records is based on the "ATM Name System Specification Version 1.0". Additional reading: • Microsoft DNS and Windows NT 4.0 White Paper http://www.microsoft.com/technet/prodtechnol/windows2000serv/plan/w2kdns2.msp... 2006-04-04 Windows 2000 Domain Naming System (DNS) Sida 3 av 46 (http://www.microsoft.com/ntserver/techresources/deployment/NTserver/dnswp.asp) • Designing the Active Directory Structure chapter in the Deployment Planning Guide • Active Directory papers http://www.microsoft.com/windows2000/technologies/directory/default.asp • "DNS and BIND" (Cricket Liu) published by O'Reilly and Associates, 3rd Edition ISBN: 1-56592-512-2 Top of page DNS Fundamentals The Domain Name System is a hierarchical distributed database and an associated set of protocols that define: • A mechanism for querying and updating the database • A mechanism for replicating the information in the database among servers • A schema of the database History of DNS DNS began in the early days of the Internet when the Internet was a small network established by the Department of Defense for research purposes. The host names of the computers in this network were managed through the use of a single HOSTS file located on a centrally administered server. Each site that needed to resolve host names on the network downloaded this file. As the number of hosts on the Internet grew, the traffic generated by the update process increased, as well as the size of the HOSTS file. The need for a new system, which would offer features such as scalability, decentralized administration, support for various data types, became more and more obvious. The Domain Name System (DNS) introduced in 1984, became this new system. With DNS, the host names reside in a database that can be distributed among multiple servers, decreasing the load on any one server and providing the ability to administer this naming system on a per-partition basis. DNS supports hierarchical names and allows registration of various data types in addition to host name to IP address mapping used in HOSTS files. By virtue of the DNS database being distributed, its size is unlimited and performance does not degrade much when adding more servers. The original DNS was based on RFC 882 (Domain names: Concepts and facilities) and RFC 883 (Domain Names–Implementation and Specification), which were superceded by RFC 1034 (Domain Names–Concepts and Facilities), and RFC 1035 (Domain Names–Implementation and Specification). RFCs that describe DNS security, implementation, and administrative issues later augmented these. The implementation of DNS—Berkeley Internet Name Domain (BIND)—was originally developed for the 4.3 BSD UNIX Operating System. The Microsoft implementation of DNS Server became a part of the operating system in Windows NT Server 4.0. The Windows NT 4.0 DNS Server, like most DNS implementations, has its roots in RFCs 1034 and 1035. The latest version of the Windows 2000 operating system includes a new version of DNS. The RFCs used in this version are 1034, 1035, 1886, 1996, 1995, 2136, 2308 and 2052. The Structure of DNS The Domain Name System is implemented as a hierarchical and distributed database containing various types of data including host names and domain names. The names in a DNS database form a hierarchical tree structure called the domain name space. The Hierarchy of DNS: Domain Names Domain names consist of individual labels separated by dots. For example: mydomain.microsoft.com. A Fully Qualified Domain Name (FQDN) uniquely identifies the host's position within the DNS hierarchical tree by specifying a list of names separated by dots on the path from the referenced host to the root. The following figure shows an example of a DNS tree with a host called mydomain within the microsoft.com. http://www.microsoft.com/technet/prodtechnol/windows2000serv/plan/w2kdns2.msp... 2006-04-04 Windows 2000 Domain Naming System (DNS) Sida 4 av 46 domain.